We’re building Ever Works in public. Some things may be incomplete, missing, or broken while we continue improving the platform.We’re building Ever Works in public — expect a few rough edges.
Control & safety · Multi-tenancy
An Organization is your workspace: Missions, Ideas, Works, Agents, Teams and Memory all belong to one, and it is what you share when you stop working alone. You do not need one to start — a new account works fine on its own — and you can hold as many as you need, switching between them from the top of the dashboard sidebar. This page is the honest map of that model: what each layer scopes, who can do what, and which parts are still deliberately coarse.
Four user-facing pieces and two you rarely think about. Everything the runtime writes lands inside one of them, and every route that takes an id checks it before the handler runs.
Under your Organizations sits one internal container per user, created lazily the first time you make an Organization. You never see it, name it or configure it — it exists so access, seats and data isolation have a single stable boundary while Organizations come and go.
One account can hold as many as you need. The switcher at the top of the dashboard sidebar lists them, ticks the active one, remembers your choice for next login, and crosses into /org/<slug>/dashboard — the canonical prefix for every page inside that workspace. Paths without the prefix are your personal scope, and slugs are globally unique, so two accounts can never claim the same one.
Settings → Organization → Members takes an email address and a Send invitation button; the recipient lands on a public /org-invite/<token> page that names the Organization, masks the address and prints the expiry. Links are single-use, bound to the invited address, and valid for seven days by default — only the SHA-256 hash is stored, so the token lives in the email and nowhere else. Revoke a pending row and the link dies on the spot.
The Company chip on + New opens Register Company: a name, an optional two-letter country code, and you get a real Organization backed by a Work of kind company that stands for the registration itself. It is recorded as a manual registration — nothing is filed with any registrar, no jurisdiction workflow runs, and the country code is stored rather than acted on. The metadata is preserved so a formation provider can be attached later without re-keying anything.
Each Work carries its own roster with four levels: Owner (the creator, implicit and never transferable), Manager, Editor and Viewer. Managers and Owners invite and change roles, Editors edit content and trigger generation, Viewers read — and only an Owner can delete the Work. Invites here are direct: the address must already have an account, and the membership exists the moment the call succeeds.
A self-hosted install has one more flag: platform admin, which unlocks cross-user operator surfaces such as admin usage reporting, the plugin allowlist and the internal deploy cluster. It is orthogonal to this model and does not bypass the ownership check on any Organization route.
None of this is an enterprise add-on. It is what every account gets, in the open-source code you can read.
Email and password, or a one-time link that works exactly once and expires after fifteen minutes. Social sign-in covers GitHub, Google, Facebook and LinkedIn, resolved at page load so an installation only ever offers what it has configured. A wrong password and an unknown address give the same undifferentiated answer, so the form cannot be used to discover who has an account.
Ticking the terms box records the document id, its version, the locale you read it in, and the SHA-256 digest of the published source — so the exact wording you agreed to can be reproduced later. The server re-checks every field against its own published corpus before writing, and a claim pointing at text that was never published is rejected rather than stored. If the documents cannot be loaded at all, registration is blocked rather than recording an empty consent.
Programmatic access uses ew_live_ keys: shown once at creation, stored only as a SHA-256 hash plus a twelve-character display prefix, with an optional expiry and a ceiling of ten per user. Send one as an x-api-key header or a bearer token; expired and revoked keys are refused at the guard. A lost key is unrecoverable by design — revoke it and issue another.
Three throttling tiers run simultaneously — 50 requests a second, 300 per ten seconds, 1000 a minute — and exceeding any one of them rejects the request. Helmet sets the security headers, CORS is an explicit allow-list, and error reporting strips authorization and cookie headers plus password, token and secret fields before anything leaves the process, with every auth route excluded from tracing outright.
Every /api/organizations/:orgId route answers the same not-found on any failure — an id that does not exist, or one that lives in somebody else's account. A probe cannot tell those two apart, so other people's Organization ids stay opaque. It is enforced by one shared guard rather than an inline check each new route has to remember to write.
The Activity Log records generations, deployments, imports, plugin changes, schedule runs and sign-ins, newest first, with Export CSV when you want it in a spreadsheet. Everything the agents write to content and code lands as ordinary commits in your own Git repository, so the history stays readable without us. And because the platform is AGPLv3 and self-hostable, you can run the whole thing where your own data rules say it has to live.
Four moves, all of them in the dashboard, none of them a support ticket.
Open the workspace switcher at the top of the sidebar and choose + Create Organization. Type a Name — the slug preview checks availability live against the API — optionally write the company Vision, and press Create. If it is your first, one dialog asks whether to move your existing Missions, Ideas and Works into it or start empty; that offer is made once and never again.
Go to Settings → Organization → Members, type an email address, and press Send invitation. A stranger receives the single-use link; someone who already has an account in this workspace is simply added, and the UI tells you so. Pending rows sit under Pending invitations with Revoke beside each, and invitations are throttled to ten a minute because each one mails an arbitrary address.
For anything narrower than "they can see the workspace", open the Work you want to share and add the person under its Members as Manager, Editor or Viewer. The address must already have an Ever Works account, and the role takes effect immediately — there is no pending state to chase. Owner stays with whoever created the Work and cannot be handed over.
Back in Settings → Organization, the Merge policy block decides whether Agents may land the pull requests they open in this Organization; individual Works and Agents underneath can still tighten any single field. Spend caps live next door rather than on the Organization: an account-wide monthly ceiling under Settings → Account → Usage & Budget, plus per-Mission, per-Idea and per-Work budgets, with the strictest of them winning.
Both the roster and the invitation carry a role column, and today it holds exactly one value — member — which is display-only rather than an authorization input. Authorization for an Organization is a single check: the account container has to be yours. That has a consequence worth stating plainly, and the invite form states it too — someone you invite can see every Organization in your account, not only the one you invited them into. An org-admin role is a deliberate deferral, not an oversight: shipping an "admin" option that granted nothing would be worse than not offering one.
Group Agents and people into nested teams, assign the Works each team owns, and see the whole organization — humans and AI — on one chart.
Learn more →Who may merge, when, and into which branches — a setting you resolve at tenant, organization, Work, and Agent level.
Learn more →Decide which agent actions run on their own, which wait for a human, and how much any of it may spend — then approve from the dashboard or the Inbox.
Learn more →Everything the dashboard does is an authenticated REST call — documented with OpenAPI, callable with an API key, and observable through signed webhooks.
Learn more →Run Ever Works in the cloud, self-host the platform with Docker Compose or Kubernetes manifests, and deploy your Works to Ever Works hosting, Vercel, or your own cluster.
Learn more →A Company is your workspace and your org — create several in one account, switch between them, and run everything inside the one you pick.
Learn more →Describe what you want to build. Ever Works researches it, ships it, and keeps it improving — content and code, owned in your own Git.